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APOLLO EXPERIENCE REPORT 
GUIDANCE AND CONTROL SYSTEMS 

By Raymond E. Wilson, Jr. 

Lyndon B. Johnson Space Center 

SUMMARY 

This report contains general descriptions of the Apollo guidance and control 
systems for the command module and the lunar module and is the general summary 
document for a series of more detailed reports on specific areas of the guidance and 
control systems. The Apollo Block I guidance and control system is briefly described 
to show the differences between the original in-flight maintenance concept and the final 
lunar -orbital -rendezvous concept. Even with the in-flight maintenance concept, the 
reliability of the Block I design was less than that of the Block II design, which incor- 
porated built-in redundancy and alternate modes of operation. The Block II concept 
includes several unique systems that provide the necessary primary operational func- 
tions and the necessary redundancy for backup and abort requirements. Some of the 
more significant recommendations and conclusions contained in the other Apollo guid- 
ance and control system reports are included in this summary report. 


INTRODUCTION 


The Apollo guidance and control (G&C) systems for the command and service 
module (CSM) and the lunar module (LM) were designed and qualified to support the 
14-day lunar mission. (Information regarding the control of unmmined Apollo missions 
is given in refs. 1 and 2. ) The design of the G&C systems included the following sub- 
systems; the stabilization and control system (SCS); the primary guidance, navigation, 
and control system (PGNCS); the entry monitor system (EMS); the orbital-rate drive. 
Earth and lunar (ORDEAL) assembly; the service propulsion system (SPS) gimbal 
actuators; the mission control programer (used on the Block I command module (CM) 
unmanned flights); and the abort guidance system (AGS). 

The Block I CM design philosophy was based on an in-flight maintenance concept. 
From early in the Apollo Program until the major Block II CM change in June 1964, 
the SCS was the primary method of flight control. The initial Apollo proposal indicated 
that the control system would also encompass a lunar landing capability. This idea, 
however, was eliminated when the lunar-orbital-rendezvous concept was adopted by 
NASA. As the primary method of flight control, the Block I system had to meet a 
standard of high reliability that could be achieved only through the use of in-flight 



maintenance. Despite the best efforts of reliability and design engineers, the mean 
time between failures for the equipment was of the same order of magnitude as the 
mission time. Hence, the most feasible solution to the problem of maintaining high 
system reliability was to provide standby redundancy in the form of onboard spares. 

At the time the Block II concept was being defined in June 1964, the in-flight 
maintenance requirement was abandoned. Because the Block I Earth-orbital reliability 
requirement was considerably less stringent than that for the Block II lunar mission, 
additional redundant circuits were not added to the Block I vehicle in lieu of onboard 
spares. Instead, the Block II system was redesigned to include redundant control paths. 

The concept of in-flight maintenance was discarded because it proved to be 
impractical. Although it was technically feasible for the astronaut to detect and replace 
a defective module, it was not an easy task. For example, in the control system lab- 
oratory, experienced and highly trained technicians often required many hours to locate 
and change a defective element. Furthermore, the changes necessary for meeting a 
new requirement to withstand much greater humidity made the installation and removal 
of the modules even more difficult. 

In the summer of 1964, the Apollo Program was divided into the Block I and 
Block II vehicle programs; the difference was that the Block II vehicles would have 
lunar -mission capability. The underlying concept of this change was that the PGNCS 
should be considered the primary mode of control and the SCS the backup mode; that is, 
the SCS was to be used for control when the PGNCS was not used. 

The Block II design of built-in redundancy and alternate modes of operational 
capability has resulted in a G&C system that is more reliable and that weighs less than 
the Block I system. In addition, the standard connectors used on Block II have been 
less troublesome than the connectors used on Block I. The problem of single-point 
failures will limit the reliability of any system. The complexity of space systems 
produces a maze of failure modes and subtle circuits that are almost impossible to 
analyze by "brute force" methods. Analysis tools and methods are needed to assist in 
the total design process and to ensure the operation of the systerti. 

The initial concept and configuration of the LM G&C system evolved during 1963 
and 1964. The initial concept was that the Government -furnished primary guidance 
system would provide the necessary guidance and navigation (G&N) functions and the 
contractor -furnished SCS would provide the vehicle stabilization and control functions. 

In addition, the SCS was to provide a backup guidance capability sufficient to permit 
insertion into a safe lunar orbit if primary guidance were lost. 

By mid-1964, the stabilization and control functions had become fairly well 
defined, and design -control specifications had been completed and subcontracts awarded 
for most assemblies. During the fall and winter of 1964, NASA (with contractor partic- 
ipation) reviewed the LM G&C requirements and the hardware capabilities of the pri- 
mary guidance system and the SCS. This review resulted in implementation of the 
integrated G&C concept. In addition, the backup or abort guidance requirements proved 
to be more complex than originally envisioned . 
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The LM G&C system includes two partial paths or systems for vehicle guidance 
and control. The PGNCS provides the necessary G&C capability for mission comple- 
tion. The AGS provides the necessary G&C capability for mission abort in the event of 
PGNCS failure, but does not provide a mission completion capability. Such a capability 
would have required a backup system having the same capability as the PGNCS and was 
prohibitive in cost, weight, and power. The SCS forms an integral part of both the 
primary and abort systems. As part of the primary system, the SCS includes the 
drivers for reaction control system (RCS) jet operation; the electronic interface for 
descent-engine thrust and gimbal control; and the hand controllers for manual-attitude, 
descent -thrust, and translational input commands. In the abort system, the SCS pro- 
vides jet-select logic, signal summing, and gain control, and the hand controllers 
used for manual input commands are the same as those used in the primary system. 
Attitude reference or steering errors are provided to the SCS by the AGS. 

The development of the PGNCS digital autopilot is described in reference 3. The 
development of the G&C hybrid simulation facility by the LM contractor is described in 
reference 4. 


DESCRIPTION OF SYSTEMS 


The CSM and LM G&C systems are described in the following paragraphs. 


Command and Service Module 

A brief functional description of the CSM G&C systems follows. The relationship 
of the SCS and the PGNCS for the Block I and Block n vehicles is shown in figures 1 
and 2, respectively. 

The PGNCS is Government -furnished equipment (GFE) and is common to both the 
CSM and the LM except for differences in the optics, minor differences in the inertial 
measurement unit (IMU) (accelerometer scaling and location of accelerometer elec- 
tronics components), and differences in the computer software programing. These 
differences are described in greater detail in reference 5. The PGNCS is divided into 
three major subsystems — inertial, optical, and computer — and designed so that 
each subsystem can be operated independently during an emergency or backup mode. 
Therefore, the failure of one subsystem will not disable the entire PGNCS. The 
three subsystems, or combinations of them, can perform the following functions. 

1. Periodically establish an inertial reference used for measurements and 
computations 

2. Calculate the position and velocity of the spacecraft by optical navigation and 
inertial guidance 

3. Generate steering signals and calculate targeting data and thrust commands 
necessary to maintain the required spacecraft trajectory 

4. Provide the astronaut with a data display that indicates the status of the G&N 
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Figure 1.- Diagram of Block I command module guidance and control system. 


The PGNCS equipment (fig. 3 and refs. 5 and 6) consists of a navigation base, an 
IMU, an optical assembly, a power and servo assembly (PSA), an Apollo CM computer 
(CMC), display and control panels, and an electronic coupling data unit. The navigation 
base is mounted to the spacecraft sidewall and is used as a holding fixture for the IMU 
and the optical assembly. The IMU and the optical assembly are attached to and pre- 
cisely alined with the navigation base. The display and control panels comprise the 
front of the G&N structure and are located so that an astronaut can view and manually 
operate them. The PSA is located on a shelf below the navigation base. The electronic 
coupling data unit and the CMC are located on a shelf below the PSA. Two display and 
keyboard (DSKY) units are located in the vehicle, one at the main panel and the other in 
the lower equipment bay. The DSKY provides access to the CMC and furnishes status 
information to the astronauts. 

The inertial subsystem (ISS) consists of the IMU, the electronic coupling data 
unit, and portions of the PSA and the display and control panels. The ISS measures 
changes in spacecraft attitude, assists in generating steering commands, and measures 
spacecraft velocity changes. The IMU provides an inertial reference consisting of a 
stable member gimbaled for three degrees of freedom and stabilized by signals from 
three integrating gyros. Acceleration of the spacecraft is sensed by three pendulous 
accelerometers mounted on the stable member and having orthogonal input axes. The 
resultant signals from the accelerometers are supplied to the CMC, which then calcu- 
lates the total velocity. The modes of operation of the ISS can be initiated either auto- 
matically by the CMC or manually by the astronaut. 
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Figure 2. - Diagram of Block n command module guidance and control system. 


The optical subsystem (OSS) consists of a sextant and telescope, the electronic 
coupling data unit, and portions of the PSA and the display and control panels. The OSS 
provides the CMC with data obtained by measuring angles between lines of sight to 
celestial objects and provides measurements for establishing the inertial reference. 

The sextant is a high-magnification (28x), dual-line-of-sight device used for precise 
angular measurements. The telescope has a wide field of view and one line of sight and 
is used for coarse acquisition or orbital tracking of landmarks. A manual control 
stick is manipulated to position the optical lines of sight. A manually initiated timing 
mark causes the CMC to record both the angle and the time at the instant the sextant 
is properly pointed for a measurement. 

The computer subsystem consists of the CMC and portions of the display and 
control panels. The CMC, which is used to perform space -flight data handling and 
computations, is a general-purpose digital computer consisting of a core memory, 
parallel operations, and a built-in self-check capability. Programs stored in the CMC 
are selected to control and solve flight equations. The selection of the programs can 
be controlled either manually or by automatic sequencing. The computer subsystem 
calculates the steering signals and the engine discrete commands necessary to keep 
the spacecraft on a required trajectory, positions the stable member in the IMU to a 
coordinate system defined by precise optical measurements, performs limited mal- 
function isolation, and supplies pertinent spacecraft-condition information to the display 
and control panels. 
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Figure 3.- Command module primary guidance, navigation, and control system. 


The SCS (fig. 4 and ref. 7) provides (to the PGNCS) backup stabilization and con- 
trol of the spacecraft for rotational, translational, and SPS thrusting, using the CSM 
RCS and SPS-engine gimbal servomechanisms. The SCS also provides the displays and 
controls required for crew interface. The SCS is divided into three basic subsystems: 
attitude reference, attitude control, and thrust -vector control. The subsystems 
contain the elements that provide selectable functions for display, automatic and 
manual attitude control, and thrust -vector control. The components and functions 
of the SCS hardware are as follows. 

1. The reaction-jet and engine on-off control contain the solenoid drivers and 
the logic circuits necessary to control the reaction-jet automatic solenoid coils and the 
SPS-engine solenoid control valves and relays. 

2. The electronic control assembly contains the circuit elements required for 
summing, shaping, and switching the rate and attitude-error signals and the manual 
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input signals necessary to maintain backup stabilization and control in all axes for 
thrust -vector and attitude control. 

3. The electronic display assembly provides the logic circuits for establishing 
the signal sources to be displayed and the displays to be used. 

4. The gyro displays coupler provides the interface between the body rate sensors 
and displays to give an accurate readout of spacecraft attitude relative to a given refer- 
ence coordinate system. 

5. The thrust-vector position servoampltfier provides the electrical interfaces 
between the command electronics and the gimbal actuator for positioning the SPS engine. 

6. Each of the two gyro assemblies contains three sensing elements, body- 
mounted attitude gyros, and the electronics components necessary to provide output sig- 
nals proportional to angular rate or to angular displacement for each of the three body 
axes. 


7. Two flight director attitude indicators display spacecraft attitude, attitude- 
error, and angular rate information to the crewmen. 

8. The gimbal position and fuel-pressure indicator provides a redundant display 
of the SPS-engine pitch and yaw gimbal angles and a means of introducing manual trim 
of the engine gimbals. The indicator has the alternate capability for providing a display 
of Saturn n and Saturn IV-B fuel and oxidizer pressures. 

9. The attitude-set control panel provides a means of manually establishing an 
attitude reference coordinate system and a visual readout of the coordinates commanded. 

10. The translational controller provides a means of exercising manual control 
over rectilinear motion of the spacecraft in both directions along the three principal 
body axes. The translational controller also provides the capability for manual abort 
initiation during launch by counterclockwise rotation and for transfer of spacecraft 
control from the PGNCS to the SCS by clockwise rotation. 

11. Two rotational controllers provide a means of exercising manual control of 
spacecraft rotation in either direction about the three main axes and provides for 
manual thrust-vector control in the pitch and yaw axes. 

The EMS (fig. 5 and ref. 8) provides information that enables the crewmen to 
monitor the PGNCS-controlled entry performance and velocity changes, to provide 
thrust termination signals under SCS-controlled velocity changes, to manually control 
entry if the PGNCS fails, and to display very-high-frequency ranging information 
obtained between the undocked CM and LM. The system includes both hardware and 
software. The software aspects refer to the generation of flight-pattern limit lines. 

The EMS consists of two basic assemblies: the entry monitor control assembly (EMCA) 
and the entry monitor scroll assembly (EMSA). The EMCA contains the electronics 
components and is made up of integrated circuits, a range indicator, an accelerometer, 
the velocity -change/range -to -go counter logic, a pulse scaler, power supplies, and 
switches. The EMSA or load -factor/velocity (g-V) plotter assembly consists of a 
scroll of Mylar tape or film imprinted with g-onset, g-offset, and range potential lines. 
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The EMS display comprises four functional components essential to trajectory monitor- 
ing and flight control: the roll attitude indicator, the entry threshold indicator, the 
corridor verification indicator, and the flight monitor or scroll. 



Electronic control 
assembly 



Reaction-jet and engine 
on-off control 



Electronic display 
assembly 



Gyro display Gyro assemblies 1 and 2 

coupler 


Figure 4. - Command module stabilization and control system. 


The roll attitude indicator displays the angular position of the lift vector about the 
relative wind vector of the vehicle. The entry threshold indicator is a lamp that illumi- 
nates when the vehicle encounters a threshold aerodynamic acceleration level, normally 
an acceleration load factor of 0. 05g. The corridor verification indicator consists of two 
lamps, one of which illuminates at a prescribed time (normally 10 seconds) after the 
entry threshold is reached. The particular lamp illuminated depends on the measured 
acceleration level. The flight monitor or scroll is the major component and provides 
a rectilinear presentation of the entry -acceleration load factor (g) as a function of iner- 
tial velocity (V). The display is created with a Mylar tape that has a monitoring pattern 
printed on the format and an emulsion bonded on the back. The vertical axis is driven 
in proportion to the acceleration load factor. A scribe removes the emulsion to create 
the entry trajectory g-V trace as the tape translates horizontally; the flight crew then 
compares the trace to the permanently displayed monitoring pattern. 
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Figure 5. - Entry monitor system. 



Figure 6.- The ORDEAL assembly, 
showing panel and switch positions. 


The ORDEAL (fig. 6 and ref. 9) is a device that can be switched directly into the 
FDAI total -attitude circuits to perform a coordinate transformation of spacecraft pitch 
from an inertial to a local -vertical reference frame. The ORDEAL assembly is sup- 
plied as GFE and is common to both the CM and the LM. When the spacecraft panel 
switches are in the orbital-rate position, sines and cosines of the pitch angle are applied 
as inputs to a pair of resolvers in the ORDEAL electromechanical module. When the 
spacecraft panel switches are in the normal position, the ORDEAL is bypassed and the 
indicators display pitch attitudes to the inertial frame of reference. 


Lunar Module 

A brief functional description of the LM G&C system follows. The functional 
relationship between the systems that make up the G&C system is shown in figure 7. 

The PGNCS (fig. 8) serves as the autopilot in controlling the LM throughout the 
mission. Normal guidance requirements include transferring the LM from a lunar orbit 
to the descent profile, achieving a successful landing at a preselected or crew-selected 
site, and performing a powered ascent and rendezvous maneuver that results in ter- 
minal rendezvous with the CSM. If the mission is to be aborted, the PGNCS performs 
guidance maneuvers that place the LM in a parking orbit or in a trajectory that inter- 
cepts the CSM trajectory. The LM m.ission programer is described in reference 10. 

The PGNCS includes three major subsystems: inertial, optical, and computer. 
The ISS establishes the inertial reference frame that is used as the central coordinate 
system from which all measurements and computations are made. The ISS measures 
attitude and incremental velocity changes and assists in converting data for computer 
use, onboard display, or telemetry. Operation is started automatically by the guidance 
computer or by an astronaut using the computer keyboard. Once the system is ener- 
gized and alined to the inertial reference, any LM rotation is sensed by the stable mem- 
ber. The alinement optical telescope, a unity-power, periscope -type device with a 
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60° conical field of view, is operated manually by the astronauts, and data are read out 
and manually inserted into the computer through the DSKY. This feature is the major 
difference between the CSM PGNCS and the LM PGNCS. 


Manual inputs 



Figure 7. - Lunar module guidance and control system configuration diagrams. 


The computer system, as the control and data-processing center of the LM, 
enables all the G&N functions necessary for automatic control of the path and attitude 
of the vehicle. The LM computer is identical to the CSM computer except for the 
absence of stored programs. 

The SCS processes RCS and main propulsion system control signals for vehicle 
stabilization and control (fig. 9 and ref. 11). To stabilize the LM during all phases of 
the mission, the SCS provides signals that fire proper combinations of 16 RCS thrust- 
ers. These signals control attitude and translation about or along all axes; data inputs 
originate from either the PGNCS or the AGS. The SCS also processes on and off com- 
mands for the ascent and descent engines and routes automatic and manual throttle 
commands to the descent engine. Trim control of the gimbaled descent engine is also 
provided by means of gimbal drive actuators, to ensure that the thrust vector passes 
through the LM center of gravity. The SCS consists of two attitude controller assem- 
blies (ACA), two thrust and translation controller assemblies (TTCA), an attitude and 
translation control assembly (ATCA), a rate gyro assembly (RGA), gimbal drive 
actuator (GDA), and a descent-engine control assembly (DEC A). 


10 






IM guidance 
computer — 


I nertial 
measurement 
unit “X 



Figure 8.- Lunar module primary guidance, navigation, and control system. 


The ACA supply attitude rate commands (proportional to the displacement of the 
stick) to the computer and to the ATCA, supply an out-of-detent discrete command each 
time the handle is out of its neutral position, and supply a followup discrete command 
to the AGS. 

Functionally, the TTCA are three -axis integrated translation and thrust control- 
lers that enable astronauts to command vehicle translations by firing RCS thrusters 
and to throttle the descent engine between 10- and 92. 5 -percent thrust levels. 

The ATCA controls LM attitude and translation. In the PGNCS path, attitude and 
translational commands are generated and applied directly to jet drivers within the 
assembly. In the AGS path, the ATCA receives translational commands from the 
TTCA, rate-damping signals from the RGA, and attitude/rate commands and pulse 
commands from the ACA. The assembly combines attitude and translational commands 
in its logic network to select the proper thrusters to be fired for the combination of 
translation and rotation. The DECA accepts engine -on and engine -off commands from 
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Figure 9.- Lunar module stabilization 
and control system. 


the SCS control assemblies, throttle com- 
mands from the PGNCS and the TTCA, and 
trim commands from the PGNCS or the 
ATCA. The assembly applies throttle 
commands to the descent engine and routes 
trim commands to the GDA. 

The AGS (fig. 10 and ref. 12), which 
is used as a backup for the PGNCS during 
an LM mission abort, determines the LM 
trajectory or trajectories required for 
rendezvous with the CSM and can guide the 
LM from any point in the mission, from 
CSM/LM separation to CSM/LM rendez- 
vous and docking, including ascent from 
the lunar surface. The AGS can provide 
data for displays and for explicit guidance 
computations and can also enable engine 
ignition and shutdown. 

The AGS consists of a nongimbaled 
inertial reference package (the abort sen- 
sor assembly) that is rigidly strapped to 
the LM rather than mounted on a gimbaled, 
stabilized platform. The abort sensor 
assembly contains three floated, pulse- 


rebalanced, single -degree -of -freedom, rate -integrating gyros and three pendulous 
reference accelerometers. The data entry and display assembly consists of a control 



Figure 10. - Lunar module abort guidance system. 
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panel (to which electroluminescent displays and data entry pushbuttons are mounted) and 
a logic enclosure that houses logic and input/output circuits. The abort electronics 
assembly is a high-speed, general-purpose computer with special-purpose input/output 
electronics components. The computer has a memory capacity of 4096 words, of which 
half are permanent and half are temporary. 

The ORDEAL assembly in the LM is identical to the unit used in the CSM. 


CONCLUDING REMARKS AND RECOMMENDATIONS 


During the course of the development, qualification, and flight programs, the 
Apollo guidance and control systems performed in an outstanding manner. There were 
no guidance and control failures or malfunctions that precluded mission completion or 
that placed the flight crew or the mission in jeopardy. 

In general, the approaches that were used to establish and implement guidance and 
control system interfaces and checkout procedures during the integration of the systems 
in the spacecraft appear to have been sound. Consequently, few interface problems 
appeared during the integration of the systems into the spacecraft. Some of the more 
significant items that deserve careful consideration on future programs are as follows. 

1. A strong effort should be made to establish baseline requirements before the 
start of hardware design and software development processes. For example, changes 
affecting hand controllers, humidity, and in-flight maintenance caused major redesign 
efforts. 

2. A failure -analysis technique should be developed to assist in the identification 
of single-point failures. The Apollo method, in which many engineers must search 
diagrams for problems, is not altogether successful for complex systems. 

3. Criteria and methods to obtain extended -duration hardware reliability should 
be established. The long checkout times and the extended durations of some missions 
put a premium on checkout, storage, and long-life operation of equipment. 

4. Serious consideration should be given to the use of solid-state devices for 
switching instead of relays and switches. If relays are used, superscreening tests 
should be established to ensure high reliability. 

5. System integration can be best achieved if a single vendor supplies the hard- 
ware for system -level requirements such as the command and service module stabili- 
zation and control system. This approach contrasts with the lunar module stabilization 
and control system procurement, which was at the assembly level with the contractor 
retaining responsibility for integration. Although system-level procurement is not a 
panacea for all problems, interface problems are more easily avoided than with 
assembly -level procurement. 

6. Thermal-vacuum testing revealed as many failures as vibration testing 
revealed. Both environments should be used in assembly acceptance testing. 
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7. Numerous experiences in the program have demonstrated the necessity for 
having immediate access to an alternate source of qualified parts to support scheduled 
program milestones. 

8. Because of schedule constraints, the abort guidance system program (as an 
example) did not include the use of an engineering model for design evaluation before 
the system was committed to production. Many manufacturing and circuit-design prob- 
lems could have been corrected early if an engineering evaluation model had been 
available. 


9. The initial integration of the guidance and control systems with the spacecraft 
caused many problems during vehicle checkout. The participation of the subcontractors 
(for example, those who built the individual parts of the lunar module stabilization and 
control system) would have been valuable during the resolution of those problems. A 
review by the subcontractor of vehicle checkout procedures and onsite support during 
spacecraft integration would prove beneficial in future programs. 

10. Definition of vehicle test methods, particularly combined-systems and 
integrated -systems testing, should be established early to avoid interface and interfer- 
ence problems. 

11. Experience gained during the development of the Apollo digital autopilots may 
be used to avoid future design problems. Logical decision techniques should be applied 
with care in design development because conditions may exist in which these techniques 
can unexpectedly lock out entire system functions. The use of logic in avoiding 
degraded performance has to be traded off with unintended restrictions. 

12. Further research effort should be expended to develop additional analytical 
techniques for digital control system design. Adaptive design techniques making use of 
the inherent flexibility available in digital systems should also be established. 

13. Design requirements should include the requirement to preserve the capa- 
bility for monitoring system effectiveness. For example, efficient use of the delta- 
velocity capability of the Apollo service propulsion system placed only mild constraints 
on maintaining small vehicle -attitude errors and rates during the start transient; 
however, a design goal was to produce a system that minimized these start transients 
for nominal operation so that the transients would be useful indicators of potentially 
serious off-nominal conditions. 

14. Caution must also be exercised in placing too much reliance on simulation 
results for design verification without a full appreciation of the approximations that 
have been made in developing the process models and in implementing these models in 
the simulations. The implementation becomes particularly important when simulating 
high frequency dynamics in a digital computer. 

15. Engineering simulation should be recognized as a potentially large, expensive 
operation and, as such, should be given appropriate attention during the initial contract 
definition and negotiations to ensure the establishment of well-defined baseline plans 
and costs. 


14 


16. The role that simulation is expected to have in the program should be defined 
in enough specific detail to enable establishment of an appropriate simulation plan that 
is adequate, but not unnecessarily elaborate. If possible, this definition should be 
included in the request for proposal so that the contractor can provide appropriate plans 
and costs. 


17. Management of the simulation activity should be delegated in some appro- 
priate way so that the activity will receive adequate full-time attention. 

18. Consideration should be given to having large simulators that require system 
hardware constructed at Government facilities. Contractor personnel would be used as 
required during construction and during initial phases of operation; civil service 
personnel would be used later in the program. 

19. Detailed planning for large simulators should begin early in the program, but 
actual implementation should be delayed as long as possible to avoid tracking and incor- 
porating interim changes to the system being simulated. 

20. Detailed planning should be designed to ensure the inclusion of requirements 
for special-purpose equipment needed for interface or system simulation, require- 
ments for external scene generators, and provisions for data input and output. Careful 
planning is important because these requirements can become expensive. 

21. At the beginning of the proposed program, the degree of desired formality 
associated with the simulator operation should be determined so that proper plans can 
be made. Configuration control, documentation, extra sets of hard-copy data, formal 
test-readiness reviews, and anomaly reporting can create a greatly increased workload 
for support personnel. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, November 8, 1974 
914-50-00-00-72 
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